Hello Iftekhar,

Thanks for the update,

I know that I should use ftp inspect to prepare data connections, but I have not found any mentions is this supporting both types of ftp.

Can you plz though a light on this where to look for active and passive? Any cisco document for the same to have detailed explanation??

Hello Syed,

Thanks for the clear explanation of this.This is what i was looking for

Just wondering frm where did you got this info as i serached the whole cisco site but did nt got this information there?

I apriciate if you could share the link.

Hi Syed,

Thanks a ton for the answer.

Hi Syed,

There is: class-map match-all FTP-PASV-CLASS

match virtual-address 10.10.10.1 tcp eq any

Why there is any? In basic passive config there is like this:

class-map match-all FTP-CLASS

match virtual-address 10.10.10.1 tcp eq ftp

Could act + pass be like this:

class-map match-all FTP-PASV-CLASS

match virtual-address 10.10.10.1 tcp eq ftp

Thanks in advance.

Usman please read my following response for tftp loadbalancing and it will give you an idea what I meant in the FTP config.

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Data%20Center&topic=Application%20Networking&topicID=.ee7814f&fromOutline=&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc1d06f

Syed Iftekhar Ahmed

yes, can be eq ftp, however no need for the second part at all.

actually, there is no need to have separate config for active or passive. ACE can take care of the translation of embedded ip and can proxy the corresponding second channel well for both active and passive mode.

tested on ver A2(1.0)

So basically what you mean is that when you are matching on ftp (eq ftp), and you specify to inspect the ftp data-channel (inspect ftp) in your policy-map, it will support both active and passive initiated connections, without the need of the additional config that iftekhar has made?

We would get something like this and it supports both active and passive ftp?

serverfarm host FTPSERVERS

probe FTP-Probe

rserver FTP-Real1

inservice

rserver FTP-Real2

inservice

class-map match-all FTP-ACT-PASV-CLASS

match virtual-address 10.10.10.1 tcp eq ftp

policy-map type loadbalance first-match ftp-policy

class class-default

serverfarm FTPSERVERS

policy-map multi-match FTP

class FTP-ACT-PASV-CLASS

loadbalance vip inservice

loadbalance policy ftp-policy

loadbalance vip icmp-reply active

inspect ftp

interface vlan 10

ip address 10.10.10.100 255.255.255.0

service-policy input FTP

no shutdown

Thanks for the update.

In new code you cannot use "inspect ftp" under non-ftp VIP.

************** doesnt work ***************************

class-map match-any non-ftp-VIP

2 match virtual-address 1.1.1.1 any

policy-map multi-match xyz

class non-ftp-VIP

inspect ftp

Error: This class doesn't have tcp protocol and a specific port

***********Works*************************************

class-map match-any VIP-FTP

2 match virtual-address 1.1.1.1 tcp eq ftp

policy-map multi-match xyz

class non-ftp-VIP

inspect ftp

<--- No complains....

Syed Iftekhar Ahmed

That much I understand, but I am trying to apply this on an outbound NAT policy, not a virtual-server VIP policy.

I've been able to fix the FTP inspection on the VIPs in the manner described, but this does not help me for the outbound NAT connections which pass through the "NAT-Policy"

Hi all,

with versio 2.1.0 may you know uf there's some FTP bug?

i'll explain....sometimes (3 of 10 times) ftp from windows client (filezilla and WinScp) does not work :(.

topology is: msfc-->ace-->fwsm1+fwsm2-->ace--real

i've got mac-sticky enable and fw load balancing configure well (Cisco guideline) when i see ftp not working i noticed this stuff:

ACE# show conn address netmask 255.255.255.255

conn-id np dir proto vlan source destination state

----------+--+---+-----+----+---------------------+---------------------+------+

93675 1 in TCP 5 :1082 :21 ESTAB

8493 1 out TCP 3 :21 :1082 ESTAB

23308 1 in TCP 5 :0 :34157 SYNACK

-- - - -- -- -- -- --

44250 2 in TCP 5 :0 :34157 SYNACK

-- - - -- -- -- -- --

how can i see mac-sticky feature in some show command and above all why i can see port0 (reserved) used and as second conn '--'?

thk

Das